1. Field of the Invention
The present invention generally relates to electronic circuits and, more specifically, to the control of the execution of a program by a microprocessor.
2. Discussion of the Related Art
In most programs or algorithms executed by a microprocessor, conditional jumps, that is, steps during which the program selects the next instruction to be executed from among two different instructions can be found. Such jumps are generally decided according to the state of a flag. According to this flag, the program execution carries on with one instruction or another. The conditional jump to a different address in the program occurs at this time.
Such an operation is satisfactory in many applications. However, in programs manipulating secret quantities or more generally implementing algorithms for which it is not desired for an unauthorized user to be able to modify the program sequencing, such jumps are particularly critical points.
In particular, a common type of attack to induce secret quantities from the execution of an algorithm or to fraudulently pass tests is known as an injection attack and comprises forcing a program trap by introducing a disturbance (for example, on the processor power supply) at strategic positions in its execution. Such fault injections then enable discovering the manipulated secret quantities. For example, in simplified fashion, if a conditional jump verifies the exactness of a key against a prerecorded key, the conditional jump to the authorized instructions must not occur if the right key is not introduced into a corresponding program variable. By presenting a wrong key and by causing disturbances on the program execution (fault injection), a wrong (illicit) conditional jump resulting in the acceptance of the wrong key will statistically occur. Now, it is enough for the jump to be allowed once to enable a hacker to exploit the processings executed by the algorithm and thus hack the program.
A known technique for protecting a program against fault injections comprises calculating signatures of two executions of a same program to compare these signatures with a prerecorded signature or with respect to each other. This requires two executions of the program, and thus either two hardware cells, or twice as much time. Further, the integrated circuit executing the program needs to have functions enabling to calculate the corresponding signatures.
US patent application No 2005/0257033 (04-RO-030, B6511) describes a solution according to which a jump address is calculated according to a result over several bits indicative of the fact that a desired condition is fulfilled, program blocking instructions being placed at the respective addresses to which the jump leads in the case where the expected condition is not fulfilled. The selection of the branching addresses needs to be performed on creation of the program contained in the non-volatile memory. The areas containing the blocking instructions are thus dedicated to a specific test.